Greeting, FYI, we noticed BUG:kernel_NULL_pointer_dereference,address due to commit (built with gcc-11): commit: 94dd2d69bf084166a5537f957dac6a3b79fa238f ("[PATCH -next 5/7] mm: memory: convert wp_page_copy() to use folios") url: https://github.com/intel-lab-lkp/linux/commits/Kefeng-Wang/mm-huge_memory-make-__do_huge_pmd_anonymous_page-to-take-a-folio/20230112-161810 base: https://git.kernel.org/cgit/linux/kernel/git/akpm/mm.git mm-everything patch link: https://lore.kernel.org/all/20230112083006.163393-6-wangkefeng.wang@huawei.com/ patch subject: [PATCH -next 5/7] mm: memory: convert wp_page_copy() to use folios in testcase: boot on test machine: qemu-system-x86_64 -enable-kvm -cpu SandyBridge -smp 2 -m 16G caused below changes (please refer to attached dmesg/kmsg for entire log/backtrace): [ 6.211602][ T64] BUG: kernel NULL pointer dereference, address: 0000000000000008 [ 6.213035][ T64] #PF: supervisor read access in kernel mode [ 6.214169][ T64] #PF: error_code(0x0000) - not-present page [ 6.215275][ T64] PGD 80000001202fc067 P4D 80000001202fc067 PUD 1202f9067 PMD 0 [ 6.216694][ T64] Oops: 0000 [#1] SMP PTI [ 6.217525][ T64] CPU: 1 PID: 64 Comm: modprobe Not tainted 6.2.0-rc3-00317-g94dd2d69bf08 #1 [ 6.219042][ T64] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-debian-1.16.0-5 04/01/2014 [ 6.220947][ T64] RIP: 0010:_compound_head (include/linux/page-flags.h:251) [ 6.221957][ T64] Code: 66 2e 0f 1f 84 00 00 00 00 00 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 <48> 8b 47 08 a8 01 75 24 66 90 48 89 f8 c3 cc cc cc cc f7 c7 ff 0f All code ======== 0: 66 2e 0f 1f 84 00 00 nopw %cs:0x0(%rax,%rax,1) 7: 00 00 00 a: 66 66 2e 0f 1f 84 00 data16 nopw %cs:0x0(%rax,%rax,1) 11: 00 00 00 00 15: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1) 1a: 90 nop 1b: 90 nop 1c: 90 nop 1d: 90 nop 1e: 90 nop 1f: 90 nop 20: 90 nop 21: 90 nop 22: 90 nop 23: 90 nop 24: 90 nop 25: 90 nop 26: 90 nop 27: 90 nop 28: 90 nop 29: 90 nop 2a:* 48 8b 47 08 mov 0x8(%rdi),%rax <-- trapping instruction 2e: a8 01 test $0x1,%al 30: 75 24 jne 0x56 32: 66 90 xchg %ax,%ax 34: 48 89 f8 mov %rdi,%rax 37: c3 retq 38: cc int3 39: cc int3 3a: cc int3 3b: cc int3 3c: f7 .byte 0xf7 3d: c7 (bad) 3e: ff 0f decl (%rdi) Code starting with the faulting instruction =========================================== 0: 48 8b 47 08 mov 0x8(%rdi),%rax 4: a8 01 test $0x1,%al 6: 75 24 jne 0x2c 8: 66 90 xchg %ax,%ax a: 48 89 f8 mov %rdi,%rax d: c3 retq e: cc int3 f: cc int3 10: cc int3 11: cc int3 12: f7 .byte 0xf7 13: c7 (bad) 14: ff 0f decl (%rdi) [ 6.225382][ T64] RSP: 0000:ffffc900004c3d38 EFLAGS: 00010282 [ 6.226529][ T64] RAX: 0000000000000a55 RBX: ffffc900004c3df8 RCX: 0000000000003663 [ 6.230756][ T64] RDX: 0000000000000000 RSI: 00000000f7f80000 RDI: 0000000000000000 [ 6.232224][ T64] RBP: ffff8881202f6240 R08: 8000000003663225 R09: ffff888120201000 [ 6.233742][ T64] R10: 0000000000000000 R11: 00000000f7f80684 R12: 00000000f7f80684 [ 6.235231][ T64] R13: 0000000000000df8 R14: 0000000000000000 R15: ffff88812024f440 [ 6.236759][ T64] FS: 0000000000000000(0000) GS:ffff88842fd00000(0063) knlGS:00000000f7ddb900 [ 6.238454][ T64] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 [ 6.239697][ T64] CR2: 0000000000000008 CR3: 00000001009e2000 CR4: 00000000000406e0 [ 6.241215][ T64] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 6.242709][ T64] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 6.244212][ T64] Call Trace: [ 6.244933][ T64] [ 6.245575][ T64] wp_page_copy (mm/memory.c:3047) [ 6.246461][ T64] ? do_anonymous_page (arch/x86/include/asm/preempt.h:85 include/linux/spinlock_api_smp.h:143 include/linux/spinlock.h:390 mm/memory.c:4106) [ 6.247440][ T64] __handle_mm_fault (mm/memory.c:5061) [ 6.248338][ T64] handle_mm_fault (mm/memory.c:5207) [ 6.249227][ T64] do_user_addr_fault (arch/x86/mm/fault.c:1407) [ 6.250166][ T64] ? do_set_thread_area (arch/x86/kernel/tls.c:152) [ 6.251133][ T64] exc_page_fault (arch/x86/include/asm/irqflags.h:40 arch/x86/include/asm/irqflags.h:75 arch/x86/mm/fault.c:1506 arch/x86/mm/fault.c:1554) [ 6.252009][ T64] asm_exc_page_fault (arch/x86/include/asm/idtentry.h:570) [ 6.252931][ T64] RIP: 0023:0xf7df587c [ 6.253753][ T64] Code: 1c 31 c0 89 5c 24 0c e8 45 d4 10 00 81 c3 96 77 18 00 89 74 24 10 87 de 0f a2 87 de 81 f9 6e 74 65 6c 89 7c 24 14 89 6c 24 18 <89> 83 90 36 00 00 75 14 81 fe 47 65 6e 75 75 0c 81 fa 69 6e 65 49 All code ======== 0: 1c 31 sbb $0x31,%al 2: c0 89 5c 24 0c e8 45 rorb $0x45,-0x17f3dba4(%rcx) 9: d4 (bad) a: 10 00 adc %al,(%rax) c: 81 c3 96 77 18 00 add $0x187796,%ebx 12: 89 74 24 10 mov %esi,0x10(%rsp) 16: 87 de xchg %ebx,%esi 18: 0f a2 cpuid 1a: 87 de xchg %ebx,%esi 1c: 81 f9 6e 74 65 6c cmp $0x6c65746e,%ecx 22: 89 7c 24 14 mov %edi,0x14(%rsp) 26: 89 6c 24 18 mov %ebp,0x18(%rsp) 2a:* 89 83 90 36 00 00 mov %eax,0x3690(%rbx) <-- trapping instruction 30: 75 14 jne 0x46 32: 81 fe 47 65 6e 75 cmp $0x756e6547,%esi 38: 75 0c jne 0x46 3a: 81 fa 69 6e 65 49 cmp $0x49656e69,%edx Code starting with the faulting instruction =========================================== 0: 89 83 90 36 00 00 mov %eax,0x3690(%rbx) 6: 75 14 jne 0x1c 8: 81 fe 47 65 6e 75 cmp $0x756e6547,%esi e: 75 0c jne 0x1c 10: 81 fa 69 6e 65 49 cmp $0x49656e69,%edx If you fix the issue, kindly add following tag | Reported-by: kernel test robot | Link: https://lore.kernel.org/oe-lkp/202301151942.4b0281d1-yujie.liu@intel.com To reproduce: # build kernel cd linux cp config-6.2.0-rc3-00317-g94dd2d69bf08 .config make HOSTCC=gcc-11 CC=gcc-11 ARCH=x86_64 olddefconfig prepare modules_prepare bzImage modules make HOSTCC=gcc-11 CC=gcc-11 ARCH=x86_64 INSTALL_MOD_PATH= modules_install cd find lib/ | cpio -o -H newc --quiet | gzip > modules.cgz git clone https://github.com/intel/lkp-tests.git cd lkp-tests bin/lkp qemu -k -m modules.cgz job-script # job-script is attached in this email # if come across any failure that blocks the test, # please remove ~/.lkp and /lkp dir to run from a clean state. -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests